Enroll a machine with a pre-authorized link key

Turn a key and a credential into the node identity the machine comes up as.

The response model is the claim route's own (D-X16-O7): a daemon that can read one answer can read the other, and the shape being the same class rather than a copy is what keeps it that way.

Everything that decides anything is in :func:~nerdit_cloud.nodes.preauth.consume_preauth_key, including the D-X16-O9 evaluation order this route must not second-guess. What is here is the metering, the shape check that makes passing the plaintext to forbidden_values safe, and the commit-then-raise the refusal path shares with every other route in this codebase.